Which of the following DNS records is used to publish X.509 certificate and certificate authority information in DNS?

Question

Options

• ADS
• BCAA
• CNSEC
• DA

• A
  6% (3)
• B
  90% (44)
• D
  4% (2)

Explanation

CAA (Certification Authority Authorization) records allow domain owners to declare which Certificate Authorities (CAs) are permitted to issue X.509 certificates for their domain, making B correct. This information is published directly in DNS, letting CAs check whether they're authorized before issuing a certificate.

Why the distractors are wrong:

• A (DS - Delegation Signer): Used in DNSSEC to establish a chain of trust between parent and child DNS zones - nothing to do with X.509 certificates.
• C (NSEC - Next Secure): Also a DNSSEC record, used to provide authenticated denial of existence (proving a record doesn't exist) - unrelated to certificate issuance.
• D (A record): Simply maps a hostname to an IPv4 address - the most basic DNS record type, with no security or PKI function.

Memory tip: CAA spells out its own purpose - Certificate Authority Authorization. If you see "CA" in a DNS question about who's allowed to issue certs, think CAA.

No community discussion yet for this question.